Attachment 36472 Details for Bug 82635

CESA-2005-002.txt

CESA-2005-002.txt (text/plain), 998 bytes, created by Ludwig Nussel on 2005-05-05 10:02:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-05-05 10:02:29 UTC

Size: 998 bytes

patch

obsolete

>CESA-2005-002 - rev 1
>
>bzip2 decompression bomb vulnerability
>======================================
>
>Programs affected: bzip2 and programs which reuse bzip2 (such as the Mac OS/X
>decompressor)
>Severity: Decompression bomb leading to DoS
>Discovered date: May 4th 2005
>Vendor notified date: May 4th 2005
>
>Whilst playing with "random bitflipping" technology, an effective decompression
>bomb attack against bzip2 was identified. bzip2 can be made to decompress
>into a file indefinitely when it encounters a suitably corrupt bzip2 archive.
>
>Demo bz2 archive:
>http://scary.beasts.org/security/d5d5466da311d907/bomb.bz2
>
>Attack vectors
>==============
>
>Possible attack vectors include:
>- Attacks against anti-virus gateways to mount DoS or scan bypass attacks.
>- Mailing the bomb to a victim to fill their disk, causing a DoS. This will
>be particularly effective if the victim's mail client or desktop automatically
>inspect or index the archive.
>
>CESA-2005-002 - rev 1
>Chris Evans
>chris@scary.beasts.org
>

Actions: View

Attachments on bug 82635: 36472 | 37059 | 37120